CVE-2012-2626
EXPLOITEDPlixer Scrutinizer <9.5.0 - RCE
Title source: llmDescription
cgi-bin/admin.cgi in the web console in Plixer Scrutinizer (aka Dell SonicWALL Scrutinizer) before 9.5.0 does not require token authentication, which allows remote attackers to add administrative accounts via a userprefs action.
Exploits (2)
exploitdb
WORKING POC
VERIFIED
by Mario Ceballos · textwebappscgi
https://www.exploit-db.com/exploits/37549
metasploit
WORKING POC
by MC, Jonathan Claudius, Tanya Secker, sinn3r · rubypoc
https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/admin/http/scrutinizer_add_user.rb
Scores
EPSS
0.7598
EPSS Percentile
98.9%
Details
VulnCheck KEV
2024-10-01
CWE
CWE-287
Status
published
Products (1)
sonicwall/scrutinizer
< 9.5.0
Published
Jul 31, 2012
Tracked Since
Feb 18, 2026